Privacy Policy

1. About this policy and personal data

Personal data means information about an individual who can be identified from that information alone, or together with other information we have or are likely to have access to. This may include your contact details, a booking linked to your name, or online identifiers associated with you.

This policy covers our handling of personal data for vehicle enquiries, test drives, trade-in requests, restaurant reservations, private event enquiries, promotions and related customer communications. Where a particular service has an additional privacy notice, please read that notice together with this policy.

2. Personal data we collect

The information collected depends on how you interact with us. It may include:

• Contact details: your name, salutation, email address and telephone number when you submit a form or contact our team.
• Vehicle enquiries and appointments: models you are interested in, preferred showroom or roadshow location, and your preferred test-drive date and time.
• Trade-in information: your vehicle registration number, mileage and the replacement model you are considering.
• Reservations and events: booking contact details, preferred venue, date, meal period, number of guests, event type, preferred space and information you choose to provide with your enquiry or through a reservation provider.
• Correspondence and submissions: information you provide in enquiries, feedback, promotion entries or applications emailed through our careers links, together with records needed to respond to you.
• Website and advertising information: browser and device information, pages visited, referring pages, interactions, advertising click identifiers, cookie identifiers and the campaign or source associated with your visit or form submission.

Please provide only information relevant to your request. If you provide another person's personal data, such as a booking contact, please ensure you are authorised to do so and that they are aware of the relevant purposes and this policy.

3. How we collect personal data

We collect personal data directly when you complete website forms, make a booking, register interest, request a trade-in estimate, or communicate with us by email, telephone or messaging services. We also collect information through cookies, pixels and similar website technologies, as explained below. Where appropriate and permitted by law, we may receive information from a person authorised to act for you or a service provider helping to fulfil your request.

4. Why we collect, use and disclose personal data

Depending on your interaction with us, we use personal data to:

• Respond to enquiries and provide information about vehicles, offers and services you request.
• Arrange test drives, follow up on vehicle interest and process trade-in enquiries.
• Manage restaurant reservations, private event enquiries, pre-orders and related service communications.
• Administer promotions and respond to feedback, support requests or job applications.
• Send marketing communications where we have the necessary consent or are otherwise permitted by law.
• Understand website usage, measure advertising and enquiry conversions, and improve our website and services. The cookies and advertising section explains the identifiers and contact information used for this purpose.
• Maintain relevant business records, handle disputes, prevent misuse and meet legal or regulatory requirements.

Our collection, use and disclosure must be for purposes that a reasonable person would consider appropriate in the circumstances. If we intend to use your data for a new purpose, we will notify you and obtain consent where the PDPA requires it.

5. Consent and notification of purposes

We collect, use or disclose personal data with your consent, where consent is deemed under the PDPA, or where an applicable law permits or requires it without consent. For example, providing your contact details to arrange a test drive may allow us to use those details to handle that request. It does not give unrestricted permission to use them for unrelated purposes.

We will explain the relevant purposes when collecting your data, including through this policy and notices accompanying our services. We must not require consent to uses beyond what is reasonable to provide a product or service as a condition of providing it. Reading this policy or browsing the website does not, by itself, constitute consent to every use of personal data described here.

6. Marketing communications and the Do Not Call Registry

Where permitted, we may contact you about vehicle offers, events, dining promotions and related services by email, telephone, SMS or messaging platforms such as WhatsApp. Where Singapore's Do Not Call (DNC) provisions apply, marketing to a Singapore telephone number requires the relevant DNC checks unless we have clear and unambiguous consent in evidential form or another applicable exception.

You can opt out of marketing by using the unsubscribe instructions in a message or by emailing helpdesk@byd.1826.sg. Please identify the email address or telephone number and the communications you wish to stop. We will give effect to your request within the applicable legal timeframe. Opting out of marketing does not prevent necessary communications about a booking, enquiry, transaction or service you have requested.

7. Cookies, analytics and advertising technologies

Our website uses cookies, browser storage, pixels and similar technologies to support website functions, understand visits and interactions, and measure advertising results. A cookie is a small file stored in your browser; browser storage can retain information such as the advertising source associated with your visit.

• Google Analytics and Google Ads: help measure website activity and conversions, such as test-drive and trade-in enquiries. For these enquiry conversions, our website also supplies the email address and telephone number entered in the form to Google's enhanced conversion functionality to help attribute enquiries to advertising.
• Meta Pixel and advertising attribution: help measure page visits and enquiry events. Advertising click identifiers and browser identifiers may be recorded with an enquiry so that we can understand which campaigns led to it.
• Embedded services: reservation tools and other third-party content may use their own cookies or similar technologies when you interact with them.

You can use your browser settings to block or delete cookies and clear stored website data, and use the advertising preference tools offered by Google and Meta. Some features may work differently if cookies are blocked. These settings do not withdraw consent for information already submitted to us; contact us if you wish to make a request about that information. Providers' privacy notices explain their own processing and available controls.

8. Who personal data may be shared with

For the purposes described in this policy, personal data may be disclosed to:

• Team members and representatives who need the information to handle your enquiry, booking or requested service.
• Providers supporting website hosting, form processing, communications, reservation management, payment processing, analytics and advertising measurement. For example, restaurant reservations may be made through SevenRooms.
• Professional advisers, authorities or other parties where disclosure is needed to comply with law, deal with a dispute or protect legal rights.
• Parties involved in a proposed or completed business transfer or reorganisation, where disclosure is permitted by law and subject to applicable safeguards.

Disclosures must be limited to what is appropriate for the relevant purpose. Where a provider processes personal data on our behalf, we remain responsible for our applicable obligations under the PDPA.

9. Transfers outside Singapore

Some technology and service providers may process or store personal data outside Singapore. Where we transfer personal data overseas, the PDPA requires us to ensure a standard of protection comparable to that provided under the PDPA, unless an applicable exemption applies. This may involve contractual obligations or other legally recognised safeguards. You may contact us for information about an overseas transfer relevant to your interaction with us.

10. How long personal data is retained

Personal data is retained for as long as it serves the purpose for which it was collected or is needed for legal or business purposes. The relevant period depends on the type of record, the service provided, applicable record-keeping requirements and any outstanding enquiry, complaint or dispute.

When those purposes no longer apply, we will stop retaining the personal data or remove the means of associating it with you. Withdrawing consent does not necessarily require immediate deletion of all records: some information may still be needed to meet legal obligations, resolve a dispute or record your marketing opt-out preference.

11. Protection and accuracy of personal data

We are required to make reasonable security arrangements to protect personal data in our possession or under our control against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks. The arrangements should reflect the nature of the data and the risks involved. No internet transmission or storage system can be guaranteed completely secure. Please contact us promptly if you suspect that personal data connected with our services has been compromised.

We will make reasonable efforts to ensure personal data is accurate and complete where it is likely to be used to make a decision affecting you or disclosed to another organisation. Please let us know if your contact details or other information changes so that we can update the relevant records.

12. Requesting access to or correction of personal data

Subject to the PDPA's exceptions, you may request:

• Access to personal data about you that is in our possession or under our control.
• Information about how that data has been used or disclosed during the year before your request.
• Correction of an error or omission in your personal data.

Email helpdesk@byd.1826.sg with enough detail for us to locate the relevant records. We may need to verify your identity and, if you act for someone else, your authority, before releasing or changing personal data. Please do not send identity documents or other sensitive information unless we request it and explain how to provide it.

We will respond to access requests as soon as reasonably possible and make corrections as soon as practicable. If we cannot respond to an access or correction request within 30 days after receiving it, we will inform you in writing within that period of when we expect to respond. If a reasonable fee applies to an access request, we will provide a written estimate before proceeding.

Some information may be withheld where the law requires or permits it, for example to protect another person's personal data. Where a correction is made, we will also pass the corrected data to other organisations as required by the PDPA, subject to its exceptions.

13. Consent withdrawal

Consent to the collection, use or disclosure of personal data may be withdrawn for some or all purposes on reasonable notice by emailing helpdesk@byd.1826.sg. We will explain the likely consequences and when the request will take effect. Services that require the relevant data may be affected; withdrawal for marketing alone does not affect requested services.

Once effective, we and our data intermediaries and agents will cease the relevant collection, use or disclosure, unless it is permitted or required by law without consent.

14. Data breach assessment and notification

If we become aware of a data breach, we will take steps to assess it and meet our obligations under the PDPA. A breach that results in, or is likely to result in, significant harm to individuals, or is of a significant scale, must be notified to the Personal Data Protection Commission (PDPC), subject to the applicable legal requirements.

Where notification to the PDPC is required, it must be made as soon as practicable and no later than three calendar days after determining that the breach is notifiable. Where the law requires notification to affected individuals, we will notify them as soon as practicable, at the same time as or after notifying the PDPC, with relevant information and steps they can take. Notification to individuals is generally required for breaches likely to cause significant harm, subject to the PDPA's exceptions.

15. Third-party websites and services

Our website includes links to and embedded services from other providers, such as restaurant reservation systems and payment checkout pages. When you provide information directly to a provider, its own privacy notice may also apply. Please review that notice to understand its purposes, data handling and privacy controls. This policy describes our handling of personal data and does not replace those providers' notices or our own responsibilities under the PDPA.

16. Privacy requests, questions and complaints

For questions about this policy, access or correction requests, consent withdrawal or a complaint about how we handle personal data, please contact:

Please use a subject such as "PDPA request" or "Privacy complaint" and include your preferred contact details, the relevant booking or enquiry reference if available, and a description of your request. We will review the matter and contact you if more information is needed. You may also approach the PDPC about a personal data protection concern.

For more information about Singapore's data protection framework, visit the PDPC's guide to data protection obligations.

17. Changes to this policy

We may update this policy to reflect changes in our services, data handling or legal requirements. The date at the top shows when it was last revised. Where a change requires additional notice or consent, we will provide that notice or seek consent as required. Please review the policy periodically and contact us if you need clarification.